WhatsApp Ireland Ltd

What happened

The EDPB adopted an urgent binding decision under Article 66 GDPR. Following a provisional measure taken by the Hamburg DPA against WhatsApp, the EDPB analysed WhatsApp's data sharing practices with Facebook. The EDPB did not confirm the provisional measure, but given the high likelihood that data sharing is taking place, it requested the Irish DPA to investigate certain key blind spots in WhatsApp's data processing, including whether data is actually shared with Facebook, whether Facebook acts as processor or joint controller, and whether the legal basis identified in the privacy policy is adequate in relation to the actual processing.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a)Read →
• Art. 6Lawfulness of processing6(1)(a) · 6(1)(f)Read →
• Art. 7Conditions for consentRead →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subject12(1)Read →
• Art. 13Information to be provided where personal data are collected from the data subject13(1)(c) · 13(1)(e)Read →
• Art. 61Mutual assistance61(5) · 61(8) · 61(9)Read →
• Art. 62Joint operations of supervisory authoritiesRead →
• Art. 66Urgency procedure66(1) · 66(2)Read →

• Consent
• Data principles
• Transparency
• Unlawful processing